New Observation on Camellia

Duo, Lei; Li, Chao; Feng, Keqin

doi:10.1007/11693383_4

Cited by 31 publications

(25 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…So far there have been many cryptanalytic results for reduced-round Camellia by using different approaches such as differential and linear cryptanalysis [5], truncated differential cryptanalysis [6,7], integral attack [8][9][10], meet-in-the-middle attack [11], collision attack [9,12], impossible differential cryptanalysis [7,[13][14][15][16][17][18][19] and zero-correlation linear cryptanalysis [20]. As a matter of fact, most attacks presented before 2011 excluded the F L/F L −1 and whitening layers to ease the cryptanalysis, while recent attacks aimed at reduced-round Camellia with F L/F L −1 and/or whitening layers.…”

Section: Introductionmentioning

confidence: 99%

Improved zero‐correlation linear cryptanalysis of reduced‐round Camellia under weak keys

Liu

Sun

Wang

et al. 2016

IET Information Security

View full text Add to dashboard Cite

Camellia is one of the widely used block ciphers, which has been included in the NESSIE block cipher portfolio and selected as a standard by ISO/IEC. In this work, we observe that there exist some interesting properties of the F L/F L −1 functions in Camellia. With this observation we derive some weak keys for the cipher, based on which we present the first known 8-round zero-correlation linear distinguisher of Camellia with F L/F L −1 layers. This result shows that the F L/F L −1 layers inserted in Camellia cannot resist zero-correlation linear cryptanalysis effectively for some weak keys since the currently best zero-correlation linear distinguisher for Camellia without F L/F L −1 layers also covers 8 rounds. Moreover, by using the novel distinguisher, we launch key recovery attacks on 13-round Camellia-192 and 14-round Camellia-256 respectively. To our knowledge, these results are the best for Camellia-192 and Camellia-256 with F L/F L −1 and whitening layers.

show abstract

Section: Introductionmentioning

confidence: 99%

Improved zero‐correlation linear cryptanalysis of reduced‐round Camellia under weak keys

Liu

Sun

Wang

et al. 2016

IET Information Security

View full text Add to dashboard Cite

show abstract

“…In the past years, Camellia has attracted the attention of the cryptanalytic community. The square-type attacks are efficient to attack Camellia, which can be used to analysis 9-round Camellia-128 and 10-round Camellia-256 [11]. Furthermore, Hatano et al used the higher order differential attack to analysis the last 11 rounds Camellia-256 with complexity 2 255.6 [7].…”

Section: Introductionmentioning

confidence: 99%

New Impossible Differential Attacks of Reduced-Round Camellia-192 and Camellia-256

Chen

Jia

et al. 2011

Information Security and Privacy

View full text Add to dashboard Cite

Abstract. Camellia is a block cipher selected as a standard by ISO/IEC, which has been analyzed by a number of cryptanalysts. In this paper, we propose several 6-round impossible differential paths of Camellia with the F L/F L −1 layer in the middle of them. With the impossible differential and a well-organized precomputational table, impossible differential attacks on 10-round Camellia-192 and 11-round Camellia-256 are given, and the time complexity are 2 175 and 2 206.8 respectively. An impossible differential attack on 15-round Camellia-256 without F L/F L −1 layers and whitening is also be given, which needs about 2 236.1 encryptions. To the best of our knowledge, these are the best cryptanalytic results of Camellia-192/-256 with F L/F L −1 layers and Camellia-256 without F L/F L −1 layers to date.

show abstract

“…Later, Ref. [11] adopted the equivalent structure of Feistel cipher that improved the known results of Square attack on Camellia. Reference [12] gave an efficient collision attack on Camellia, and later in Ref.…”

Section: Introductionmentioning

confidence: 99%

Security research with Square attack to a variant Camellia cipher

Zhang

2010

Front. Electr. Electron. Eng. China

View full text Add to dashboard Cite

This paper investigates the relation between the choice of S-boxes and Square attack. A variant Camellia, which uses only a single S-box instead of four, is proposed. The security of the variant Camellia against Square attack is studied in detail. Result shows that it needs only 28 chosen plaintexts to recover a byte of the 6th round-key of variant Camellias, while the original Camellia needs either 28 chosen plaintexts to recover a byte of the 6th round-key and a byte of some constant or 216 chosen plaintexts to recover a byte of the 6th roundkey. Furthermore, Square attacks on other round-reduced variant Camellia are proposed, and the time complexity of 11-round attack is reduced from 2 250 to 2 225.5 . The weaker variant Camellia indicates that the choice of S-box and the order of different S-boxes have influence on Square attack.

show abstract

New Observation on Camellia

Cited by 31 publications

References 11 publications

Improved zero‐correlation linear cryptanalysis of reduced‐round Camellia under weak keys

Improved zero‐correlation linear cryptanalysis of reduced‐round Camellia under weak keys

New Impossible Differential Attacks of Reduced-Round Camellia-192 and Camellia-256

Security research with Square attack to a variant Camellia cipher

Contact Info

Product

Resources

About